StackRadar

CVE-2026-77387

Medium

Advisory

Published 2 Oct 2026In the index since 3 Oct 2026
Severity
Medium
worst across findings
CVSS
4.0
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
30
of 17,985 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

Carried by container images the latest versions of 30 of 17,985 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
geopypypi1.11.0, 1.20.0, 2.1.0, 2.2.0+3 more2.5.024
OSV records
GHSA-mhvh-fq92-pfmr

Charts affected

30 by stars
ChartLatestAffected imagesRadar Score
home-assistanthelm-hassVerified publisher0.3.831 of 1See more

home-assistant helm-hass 0.3.83

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
geopy@2.3.0
2.5.0

Open the chart page →

2,897
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
geopy@2.1.0
2.5.0

Open the chart page →

8,895
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
geopy@2.3.0
2.5.0

Open the chart page →

7,220
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
geopy@1.20.0
2.5.0

Open the chart page →

7,558
home-assistantalekcVerified publisher2.11.41 of 1See more

home-assistant alekc 2.11.4

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
geopy@2.3.0
2.5.0

Open the chart page →

2,897
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
geopy@2.3.0
2.5.0

Open the chart page →

2,963
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
geopy@1.20.0
2.5.0

Open the chart page →

141,666
home-assistanthome-assistantVerified publisher0.5.111 of 3See more

home-assistant home-assistant 0.5.11

1 of the 3 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
geopy@2.3.0
2.5.0

Open the chart page →

3,153
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
geopy@2.3.0
2.5.0

Open the chart page →

5,559
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latestd89226851697
geopy@2.3.0
2.5.0

Open the chart page →

2,897
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
geopy@2.2.0
2.5.0

Open the chart page →

9,084
home-assistantloeken-at-homeVerified publisher2026.5.11 of 1See more

home-assistant loeken-at-home 2026.5.1

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.5.14ce6abc553b3
geopy@2.3.0
2.5.0

Open the chart page →

3,841
home-assistantpree-helm-chartsVerified publisher1.82.01 of 1See more

home-assistant pree-helm-charts 1.82.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
geopy@2.3.0
2.5.0

Open the chart page →

2,897
supersetcloudnativeapp1.1.61 of 1See more

superset cloudnativeapp 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
amancevice/superset:0.28.1c8c04bfe3d66
geopy@1.11.0
2.5.0

Open the chart page →

6,549
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
geopy@2.3.0
2.5.0

Open the chart page →

7,359
supersetdeliveryheroVerified publisher1.1.31 of 1See more

superset deliveryhero 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
geopy@2.4.1
2.5.0

Open the chart page →

2,645
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
geopy@2.4.1
2.5.0

Open the chart page →

9,588
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
geopy@2.3.0
2.5.0

Open the chart page →

3,005
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
geopy@2.3.0
2.5.0

Open the chart page →

5,548
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
geopy@2.4.1
2.5.0

Open the chart page →

2,645
supersethelmforgeVerified publisher1.3.71 of 5See more

superset helmforge 1.3.7

1 of the 5 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
geopy@2.4.1
2.5.0

Open the chart page →

6,160
homeassistanthomeenterpriseinc0.3.01 of 1See more

homeassistant homeenterpriseinc 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2022.3.5565751f33794
geopy@2.1.0
2.5.0

Open the chart page →

8,888
kweather-chartjamoos0.1.01 of 1See more

kweather-chart jamoos 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
jamoos/kweather:history163e2e8a6e87
geopy@2.4.1
2.5.0

Open the chart page →

714
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
geopy@2.4.1
2.5.0

Open the chart page →

5,384
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
geopy@2.3.0
2.5.0

Open the chart page →

7,627
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
geopy@2.3.0
2.5.0

Open the chart page →

3,259
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
geopy@2.3.0
2.5.0

Open the chart page →

5,716
evsantisbon0.2.01 of 5See more

ev santisbon 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
santisbon/evworker:lateste807283f8d69
geopy@2.4.0
2.5.0

Open the chart page →

15,303
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
geopy@2.3.0
2.5.0

Open the chart page →

4,799
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-77387.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
geopy@2.2.0
2.5.0

Open the chart page →

7,589

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/superset:6.1.0:latest16b50bbef664
geopy@2.4.1
2.5.0
3
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
geopy@2.3.0
2.5.0
3
amancevice/superset:0.35.212a0a9e66550
geopy@1.20.0
2.5.0
2
ghcr.io/home-assistant/home-assistant:2026.9.3:latestd89226851697
geopy@2.3.0
2.5.0
2
amancevice/superset:0.28.1c8c04bfe3d66
geopy@1.11.0
2.5.0
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
geopy@2.2.0
2.5.0
1
apache/superset:4.0.1ab9467fd712c
geopy@2.2.0
2.5.0
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
geopy@2.3.0
2.5.0
1
homeassistant/home-assistant:2022.3.5565751f33794
geopy@2.1.0
2.5.0
1
homeassistant/home-assistant:2026.75a531753cea9
geopy@2.3.0
2.5.0
1
homeassistant/home-assistant:2023.12.48d000332b09b
geopy@2.3.0
2.5.0
1
jamoos/kweather:history163e2e8a6e87
geopy@2.4.1
2.5.0
1
loeken/home-assistant:2026.5.14ce6abc553b3
geopy@2.3.0
2.5.0
1
santisbon/evworker:lateste807283f8d69
geopy@2.4.0
2.5.0
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
geopy@2.4.1
2.5.0
1
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
geopy@2.3.0
2.5.0
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
geopy@2.3.0
2.5.0
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
geopy@2.3.0
2.5.0
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
geopy@2.3.0
2.5.0
1
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
geopy@2.3.0
2.5.0
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
geopy@2.1.0
2.5.0
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
geopy@2.3.0
2.5.0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
geopy@2.3.0
2.5.0
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
geopy@2.4.1
2.5.0
1

syft 1.42.1 · advisories as of 3 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.